Data leak - passwords compromised

[UrBaN963]

So my iPhone just gave me a pop-up about a data leak and passwords being compromised.

Might be a good idea to update your passwords if you haven’t changed them recently. It warned me of specific apps where the password was compromised, as well as others which should be changed.

There were more but this should suffice.

 

[CheddarByte]

This friends, is why we don't re-use passwords across multiple sites.
It's cool that i-devices are now able to check this.
Firefox is also able to tell you if you're using a compromised password.
You can check what usernames / passwords of your might be in the wild on troy hunts great website:

Have I Been Pwned: Check if your email address has been exposed in a data breach

Have I Been Pwned allows you to check whether your email address has been exposed in a data breach.

haveibeenpwned.com

 

[UrBaN963]

This friends, is why we don't re-use passwords across multiple sites.
It's cool that i-devices are now able to check this.
Firefox is also able to tell you if you're using a compromised password.
You can check what usernames / passwords of your might be in the wild on troy hunts great website:

Have I Been Pwned: Check if your email address has been exposed in a data breach

Have I Been Pwned allows you to check whether your email address has been exposed in a data breach.

haveibeenpwned.com

These passwords were all unique.

 

[3WA]

These passwords were all unique.

Yeah, Keychain would've had an additional notice if you were reusing passwords. Nice feature.

I didn't get any recent notices about leaked passwords.

 

[CheddarByte]

These passwords were all unique.

That's frightening.
Complex or non-complex?

The reason I ask is because it's possible to have 'false'-positives when it comes to this, eg: your google password is a password that someone else used, on a compromised site, which then got leaked, but not necessarily tied to you.

If you have a complex password only used once in existence, it shouldn't show up unless that place was compromised, which makes me wonder why your google account password shows as compromised.
secret google leak?!?!? /s

 

[UrBaN963]

That's frightening.
Complex or non-complex?

The reason I ask is because it's possible to have 'false'-positives when it comes to this, eg: your google password is a password that someone else used, on a compromised site, which then got leaked, but not necessarily tied to you.

If you have a complex password only used once in existence, it shouldn't show up unless that place was compromised, which makes me wonder why your google account password shows as compromised.
secret google leak?!?!? /s

Alphanumeric with special characters.

I don't know man. Maybe more will be known in the future.

 

[Privateuser456]

So my iPhone just gave me a pop-up about a data leak and passwords being compromised.

Might be a good idea to update your passwords if you haven’t changed them recently. It warned me of specific apps where the password was compromised, as well as others which should be changed.

There were more but this should suffice.

How did you see this on your Iphone, would like to check as well?

 

[geezer]

How did you see this on your Iphone, would like to check as well?

Settings, Passwords, Security Recommendations.

 

[UrBaN963]

How did you see this on your Iphone, would like to check as well?

I got an alert on the phone from the Passwords app.

But yes, @geezer has it correct.

 

[Privateuser456]

Settings, Passwords, Security Recommendations.

@UrBaN963

Thanks Guys, yeah I had a few breaches and moved from Lastpass to Bitwarden for all my password needs.

 

[Fulcrum29]

I have investigated every paste which is publicly available exposing 4 emails I use. The data is scrambled, right email wrong password in all instances. I changed my passwords in any case.

To be honest, I won't trust any service with my credentials. Many databases don't salt/hash your password, and many services to this day sends you your password in plain text email. There are some basic practices which isn't practised in the industry.

 

[Fulcrum29]

I had an email breach 4 years ago. Immediately I queried to remedy the situation, not going into it in detail, but this was their service reply:

I can verify its yours by the ip. I have reset the password to 8080 you can now log in.

It would have been impossible to establish because I haven't even accessed the service in 3 years. They simply returned it to me without any questions asked. I to this day believe that the entity in question had someone on the inside maliciously access email accounts in order to engage in malicious activities. This incident in question was reported to the appropriate authorities.